SCS-C02 Question 196
Select 3Your company is hosting a web application on AWS using Amazon EC2 instances behind an Application Load Balancer (ALB). Recently, users have reported slow response times, and your monitoring tools indicate a sudden and massive spike in incoming traffic from multiple IP addresses across the globe. Upon investigation, you suspect the application is under a Distributed Denial-of-Service (DDoS) attack. Which combination of actions can you take to mitigate the attack effectively?
- A
Enable AWS Shield Advanced for your resources to detect and mitigate the DDoS attack.
- B
Configure the ALB to block traffic from specific IP ranges using security groups.
- C
Set up an AWS WAF (Web Application Firewall) with rate-based rules to limit traffic from abusive IPs.
- D
Activate CloudTrail logging to monitor and analyze all incoming traffic to your application.
- E
Use Amazon CloudFront as a Content Delivery Network (CDN) in front of your ALB to absorb and distribute incoming traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
To mitigate a DDoS attack on your web application hosted on AWS, you should rely on services specifically designed to handle such threats. AWS Shield Advanced provides dedicated DDoS protection, AWS WAF can enforce rate-based rules to manage abusive IPs, and Amazon CloudFront can act as a CDN to absorb and distribute traffic. These combined approaches ensure that your application remains resilient against DDoS attacks. Security groups and CloudTrail, while useful for other purposes, are not directly effective for DDoS mitigation.
- A. Correct.
Enabling AWS Shield Advanced provides advanced DDoS protection for your application, including real-time attack mitigation and access to the AWS DDoS response team (DRT).
- B. Incorrect.
Security groups cannot be configured directly on the ALB to block traffic; they are applied to EC2 instances and do not provide the granularity needed for DDoS mitigation.
- C. Correct.
AWS WAF allows you to create rate-based rules to automatically block traffic that exceeds a defined threshold, which can help mitigate abusive IPs during a DDoS attack.
- D. Incorrect.
CloudTrail is useful for logging API activity, but it does not mitigate DDoS attacks or control incoming traffic.
- E. Correct.
Amazon CloudFront, when used as a CDN, distributes and absorbs large amounts of incoming traffic, effectively mitigating volumetric DDoS attacks.